US20110179268A1 - Protecting applications with key and usage policy - Google Patents

Abstract

One or more files of an application are obtained and configured as a virtual storage volume. An application package is generated by encrypting, using a key, the one or more files configured as a virtual storage volume. A license generation module generates a license including both a usage policy for the application and the key. A computing device, to run the application, obtains and attempts to authenticate the application package. If the application package is authenticated, then a license associated with the application package is obtained and at least part of the application package is decrypted using the key in the license. A virtual storage volume that includes the application is mounted, and the application is executed in accordance with the usage policy in the license. However, if the application is not authenticated, then the application is not executed.

Description

BACKGROUND
• As computers have become increasingly commonplace, a large number of different programs have become available for use on computers. This widespread use of computers and computer programs, however, has not come without its problems. One such problem is that sometimes the computer programs can be transferred and used on computers that do not have the right to do so. This can result in a loss to the computer program developer in light of the time and effort invested by the computer program developer in creating the program.
SUMMARY
• This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
• In accordance with one or more aspects, an application package creation service obtains one or more files of an application and configures the one or more files as a virtual storage volume. The service generates an application package by encrypting, using an encryption key, the one or more files configured as a virtual storage volume. A license generation module is able to generate a license including both a usage policy for the application and the encryption key.
• In accordance with one or more aspects, an application package including an encrypted application is obtained and an attempt is made to authenticate the application package. If the application package is authenticated, then a license associated with the application package is obtained and at least part of the application package is decrypted using a decryption key in the license. A virtual storage volume that includes the application is mounted, and the application is executed. However, if the application is not authenticated, then the application is not executed.
BRIEF DESCRIPTION OF THE DRAWINGS
• The same numbers are used throughout the drawings to reference like features.
• FIG. 1 illustrates an example system implementing the protecting applications with a key and usage policy in accordance with one or more embodiments.
• FIG. 2 illustrates an example application package creation service in accordance with one or more embodiments.
• FIG. 3 illustrates an example application package and associated license in accordance with one or more embodiments.
• FIG. 4 illustrates an example computing device in accordance with one or more embodiments.
• FIG. 5 is a flowchart illustrating an example process for creating an application package in accordance with one or more embodiments.
• FIG. 6 is a flowchart illustrating an example process for using an application package and associated license in accordance with one or more embodiments.
• FIG. 7 illustrates an example computing device that can be configured to implement the protecting applications with a key and usage policy in accordance with one or more embodiments.
DETAILED DESCRIPTION
• Protecting applications with a key and usage policy is discussed herein. An application includes one or more files, and those one or more files are configured as a virtual storage volume and encrypted to form an application package. A license associated with the application package is also generated, the license including both the key used to encrypt the one or more files and a usage policy for the application. In order to execute the application, a computing device obtains and authenticates the application package. After the application package is authenticated, the computing device uses the key in the license to decrypt the application in the application package, and executes the application in accordance with the usage policy included in the license.
• References are made herein to symmetric key cryptography, public key cryptography and public/private key pairs. Although such key cryptography is well-known to those skilled in the art, a brief overview of such cryptography is included here to assist the reader. In public key cryptography, an entity (such as a user, hardware or software component, a device, a domain, and so forth) has associated with it a public/private key pair. The public key can be made publicly available, but the entity keeps the private key a secret. Without the private key it is computationally very difficult to decrypt data that is encrypted using the public key. So, data can be encrypted by any entity with the public key and only decrypted by an entity with the corresponding private key. Additionally, a digital signature for data can be generated by using the data and the private key. Without the private key it is computationally very difficult to create a signature that can be verified using the public key. Any entity with the public key can use the public key to verify the digital signature by executing a suitable digital signature verification algorithm on the public key, the signature, and the data that was signed.
• In symmetric key cryptography, on the other hand, a shared key (also referred to as a symmetric key) is known by and kept secret by the two entities. Data can be encrypted with the shared key using a suitable symmetric encryption algorithm, and any entity having the shared key is able to decrypt data encrypted with that shared key. Without the shared key it is computationally very difficult to decrypt data that is encrypted with the shared key. So, if two entities both know the shared key, each can encrypt data that can be decrypted by the other, but other entities cannot decrypt the data if the other entities do not know the shared key. Additionally, digital signatures can be generated based on symmetric key cryptography, such as using a keyed-hash message authentication code mechanism. Any entity with the shared key can generate and verify the digital signature. For example, a trusted third party can generate a symmetric key based on an identity of a particular entity, and then can both generate and verify digital signatures for that particular entity (e.g., by encrypting or decrypting the data using the symmetric key).
• FIG. 1 illustrates anexample system100 implementing the protecting of applications with a key and usage policy in accordance with one or more embodiments.System100 includes acomputing device102, an applicationpackage creation service104, an applicationpackage distribution service106, and alicensing service108. Various ones ofdevice102 andservices104,106, and108 can communicate with one another via anetwork110.Network110 can be a variety of different networks, including the Internet, a local area network (LAN), a telephone network, an intranet, other public and/or proprietary networks, combinations thereof, and so forth. Although asingle computing device102, single applicationpackage creation service104, single applicationpackage distribution service106, andsingle licensing service108 are illustrated insystem100, alternativelysystem100 can include one ormore devices102, one or more applicationpackage creation services104, one or more applicationpackage distribution services106, and/or one ormore licensing services108.
• Computing device102 is typically used by a user to execute an application and/or perform other operations, and thus is also referred to as a user device.Computing device102 can be a variety of different types of devices. For example,computing device102 can be a desktop computer, a laptop or netbook computer, a mobile station, an entertainment appliance, a set-top box communicatively coupled to a display device, a television, a cellular or other wireless phone, a portable audio/video playback device, a game console, an automotive computer, and so forth. Thus,computing device102 may range from a full resource device with substantial memory and processor resources (e.g., personal computers, game consoles) to a low-resource device with limited memory and/or processing resources (e.g., traditional set-top boxes, hand-held game consoles).
• Services104,106, and108 can each be implemented as one or more computing devices. Similar to the discussion ofcomputing device102,services104,106, and108 can each be implemented using one or more of a variety of different types of devices, ranging from full resource devices with substantial memory and processor resources to low-resource devices with limited memory and/or processing resources. Additionally, although illustrated as separate services, it is to be appreciated that two or more ofservices104,106, and108 can be combined into a single service. Furthermore, it is also to be appreciated that the functionality of one or more ofservices104,106, and108 can be separated into multiple services.
• Applicationpackage creation service104 manages the creation of application packages. An application includes one or more files including data and/or instructions used in executing the application. These files are obtained byservice104 and configured as a virtual storage volume. These files, configured as a virtual storage volume, are then encrypted using an encryption key to form an application package. The encryption key is included in a license associated with the application package, as discussed in more detail below.
• Applicationpackage distribution service106 obtains the application packages from applicationpackage creation service104 and manages the distribution of the application packages to computing devices, such ascomputing device102.Service106 can communicate an application package tocomputing device102 vianetwork110, or alternatively via another communication medium. For example,service106 can manage the sending of a disc including the application package tocomputing device102. Alternatively, application packages can be communicated tocomputing device102 from other sources, such as other user devices.
• Application packages can be communicated tocomputing device102 in response to a variety of different events. For example, an application package can be communicated tocomputing device102 in response to a request for a particular application or application package from a user ofdevice102, a request from a module or component ofcomputing device102, a request from a user of applicationpackage distribution service106, a request from another device, and so forth.
• Licensing service108 manages the distribution of licenses associated with application packages. The license can be generated by any of various entities that have the encryption key, such aslicensing service108. Each license includes both a usage policy that identifies one or morerights computing device102 has regarding using the application in the application package associated with the license, and a decryption key. This decryption key is the same key as was used by applicationpackage creation service104 to encrypt the one or more files of the application (or alternatively is a value from which the key used byservice104 to encrypt the one or more files can be derived). Different application packages are associated with different licenses, socomputing device102 can have different usage policies for different applications. The license, or portions thereof, is protected so that it can be used by computingdevice102, or a set of multiple devices includingcomputing device102, but not by other devices. Accordingly, the license is referred to as targeting computing device102 (andcomputing device102 is referred to as the target device of the license).
• The usage policy identifies one or more rights that a computing device has to the application, such as the right to run the application for an unlimited amount of time, the right to run the application for a limited amount of time or to run the application a limited number of times, the right to run only certain levels or portions of the application, and so forth. The particular usage policy in a license can be determined in a variety of different matters.Licensing service108 can determine the usage policy for a license, or alternatively licensingservice108 can obtain an indication of the usage policy for a license from another device or service (e.g., from application package creation service104). The usage policy can depend on, for example, whether an appropriate fee has been paid for particular rights, the desires of the author or developer of the application in the application package, the desires of an administrator oflicensing service108 and/or applicationpackage creation service104, and so forth.
• The license also includes an identifier of the application package and the symmetric key used to encrypt the one or more files in the application package. The identifier of the application package can be obtained in different manners, such as an identifier assigned bypackage creation module204 or another module ofservice200, an identifier generated by licensing service108 (e.g., a hash value generated by applying a hash function to the one or more files), and so forth. The identifier is used to distinguish the application package from other application packages.
• Licensing service108 can communicate a license tocomputing device102 in response to a variety of different events. For example, a license can be communicated tocomputing device102 in response to a request for an application package from a user ofdevice102, in response to a request from applicationpackage distribution service106, in response to a user request to run an application oncomputing device102, and so forth.
• FIG. 2 illustrates an example applicationpackage creation service200 in accordance with one or more embodiments. Applicationpackage creation service200 can be, for example,service104 ofFIG. 1. Applicationpackage creation service200 includes anapplication acquisition module202 and apackage creation module204.
• Application acquisition module202 obtains one or more files of an application for which an application package is to be created. These one or more files are various files used in executing or running the application, such as files including data and/or instructions, and can include executable or binary files, image files, audio files, text files, setting or control information files, and so forth.Application acquisition module202 can obtain the one or more files in one or more of a variety of different manners. For example, another device or module can send the one or more files toapplication acquisition module202,application acquisition module202 can access a remote device or module and retrieve the one or more files from that remote device or module,application acquisition module202 can copy the one or more files from a disk, and so forth.
• Package creation module204 obtains the one or more files of the application fromapplication acquisition module202 and creates an application package for the application.Package creation module204 configures the one or more files as a virtual storage volume that can be mounted as a storage volume by a file system of a computing device running the application. This configuration includes generating appropriate data structures and/or other information describing the organization of the one or more files on the virtual storage volume. This configuration also includes creating the appropriate integrity information (e.g., checksums or other integrity verification values) that allows the virtual storage volume to be authenticated on a segment-by-segment basis.Package creation module204 also includes those data structures, integrity information, and/or other information in the application package. The running of the application by a computing device is discussed in more detail below.
• Package creation module204 also encrypts the one or more files in the application package.Module204 uses a symmetric key, also referred to as the encryption key, and a symmetric encryption algorithm to encrypt the one or more files.Module204 can generate the symmetric key in a variety of well-known manners, or alternatively can obtain the symmetric key from another component or module.
• Package creation module204 encrypts individual segments of the one or more files. Each of these segments refers to a portion of the virtual storage volume on which the one or more files are configured. These segments correspond to, for example, the disk blocks or sectors of a magnetic hard disk on which information is stored. Encrypting the individual segments of the one or more files allows a file system of a computing device running the application to obtain and decrypt individual segments of the virtual storage volume on a segment-by-segment basis.
• In one or more embodiments,package creation module204 also generates a digital signature by digitally signing at least part of the application package thatmodule204 is creating. This digital signature can be generated using a variety of different well known digital signature algorithms. This digital signature allows another device or service (e.g.,computing device102 or applicationpackage distribution service106 ofFIG. 1) to ensure that the application package created bymodule204 was not altered after the digital signature was generated.
• FIG. 3 illustrates an example application package and associated license in accordance with one or more embodiments.FIG. 3 illustrates anapplication package300 and associatedlicense302.Application package300 includesmetadata304, theapplication306, and asignature308.Application306 is the encrypted one or more files of the application, and includes one or more code files310 (e.g., files storing executables, files storing instructions, etc.) and one or more resource files312 (e.g., files storing audio data, image data, setting information, etc.).
• Metadata304 includes various data orinformation regarding application306 and/orapplication package300. In one or more embodiments,metadata304 includes an identifier of application package300 (e.g., an identifier assigned toapplication package300 by applicationpackage creation service104 ofFIG. 1).Metadata304 can also include other data, such as a title or description ofapplication306, a thumbnail to be displayed to representapplication306, data structures and/or other information describing the organization of the one or more files on the virtual storage volume on whichapplication306 is configured, integrity information used to verify the integrity ofapplication306, and so forth.
• Signature308 is a digital signature generated by digitally signing at least part ofapplication package300. In one or more embodiments,application306 is digitally signed to generatesignature308, although other portions (e.g., metadata304) can also be digitally signed.Signature308 can be generated using a variety of different well known public key or symmetric key cryptography digital signature algorithms.Signature308 can be used by a computing device when runningapplication306 to ensure that application306 (and/or other digitally signed portions of application package300) has not been altered sincesignature308 was generated. Asingle signature308 can be generated over one or more portions ofapplication package300, or alternativelymultiple signatures308 over multiple portions ofapplication package300 can be generated and included inapplication package300. For example, onesignature308 can be generated overmetadata304, andadditional signatures308 can be generated over one or more portions ofcode310 and/orresources312.
• License302 includes anapplication package identifier322, ausage policy324, and a key326.Application package identifier322 is an identifier ofapplication package300. This identifier can be, for example, the same identifier as is included inmetadata304 ofapplication package300.Application package identifier322 identifies the application package that license302 is associated with, and thus associatesapplication package300 andlicense302.
• Usage policy324 identifies the rights that a computing device has toapplication306. A variety of different rights, as discussed above, can be identified inusage policy324.Key326 is the symmetric key used to encryptapplication306.
• Application306 is encrypted, as discussed above. Accordingly,application package300 can be distributed or communicated to arbitrary devices via arbitrary methods without any additional security precautions.
• As discussed above,license302 can be generated by the licensing service (e.g.,licensing service108 ofFIG. 1). In such situations, the application package creation service (e.g.,service104 ofFIG. 1) can communicate to the licensing service both the identifier ofapplication package300 and the key used to encryptapplication306. The key (and typically the identifier as well) is securely communicated to the licensing service in a variety of different manners (e.g., encrypting the key and identifier with a public key of the licensing service, establishing a secure communication channel based on a symmetric key, and so forth).
• Alternatively, the key used to encryptapplication306 can be derived in a manner known by both the application package creation service and the licensing service. In such situations, the key need not be securely communicated between the application package creation service and the licensing service as each such service can independently derive the key. The key used to encryptapplication306 can be derived in different manners, such as by combining (or applying another function or algorithm to)application package identifier322 and a shared secret (secret data) that is known only to licenseservice108 and applicationpackage creation service104. Similarly,application package identifier322 can be obtained or generated by the licensing service (obtained from the same source, or generated in the same manner, as the application package creation service).
• In one or more embodiments care is taken to protectlicense302 so that key326 is not divulged to entities that are not entitled to retrieve it. License302 can be protected in a variety of different manners. For example, license302 (or portion thereof, such as key326) can be encrypted using the public key of the computing device that is the target device of the license, using the public key of a set of computing devices that includes the target device of the license,license302 can be communicated to a target device via a secure communication channel established based on a symmetric key, and so forth.
• FIG. 4 illustrates anexample computing device400 in accordance with one or more embodiments. To run an application oncomputing device400, the application package including the desired application is communicated tocomputing device400. Different applications can be run oncomputing device400, including applications that are downloaded to and installed oncomputing device400, applications that are downloaded tocomputing device400 but need not be installed oncomputing device400, applications that are streamed tocomputing device400, and so forth.
• In one or more embodiments,computing device400 includes atransfer module402, anapplication package store404 and alicense store406.Transfer module402 manages the receipt of application packages communicated tocomputing device400. The received application packages are stored inapplication package store404. Although illustrated as part ofcomputing device400,application package store404 can alternatively be implemented separately from computingdevice400, such as on another device coupled to computing device400 (e.g., via a network), on a removable device, and so forth.
• Transfer module402 also manages the receipt of licenses associated with application packages from a licensing service (e.g.,licensing service108 ofFIG. 1) and storing of the licenses inlicense store406. Although illustrated as part ofcomputing device400,license store406 can alternatively be implemented separately from computingdevice400, such as on another device coupled to computing device400 (e.g., via a network), on a removable device, and so forth.
• Application package store404 andlicense store406 can be implemented on a variety of different storage media. For example,stores404 and406 can be implemented on a magnetic disk, an optical disc, a solid state memory (e.g., Flash memory), and so forth.
• Transfer module402 can obtain a license for an application at a variety of different times. In one or more embodiments, the license associated with the application package (and thus the license associated with the application) is obtained from a licensing service when the application package is obtained. The license can be communicated tocomputing device400 at the same time as the application package, optionally accompanying the application package, or alternatively at different times.
• In other embodiments, the license associated with the application package is obtained from a licensing service in response to a request (e.g., from a user or other component or module) to run the application. Alternatively, the license associated with the application package is obtained from a licensing service at other times, such as prior to receiving the associated application package, in response to detecting an application package inapplication package store404 that does not have an associated license inlicense store406, and so forth.
• The license associated with an application package is communicated tocomputing device400 in a secure manner so that the key in the license is not divulged to entities that are not entitled to retrieve the key from the license. The license can be communicated tocomputing device400 securely in a variety of different manners. In one or more embodiments, the licensing service encrypts the license using the public key ofcomputing device400. The license can then be communicated tocomputing device400 and decrypted by computingdevice400 using a private key ofcomputing device400, but cannot be decrypted by other devices that may obtain the license.
• Alternatively, the license can be securely communicated tocomputing device400 in different manners. For example, a secure communication channel based on a symmetric key can be established between the licensing service andcomputing device400. The license can be communicated from the licensing service tocomputing device400 using this secure communication channel rather than being encrypted with the public key ofcomputing device400.
• Computing device400 includes a trusted computing base (TCB)410, which includes asecure file system412,content server414, and a digital rights management (DRM)module416. Digitalrights management module416 enforces oncomputing device400 the usage policy identified in the licenses inlicense store406. Although illustrated as being included in trustedcomputing base410, digitalrights management module416 and trustedcomputing base410 can alternatively be separate components. Digitalrights management module416 can also forward information regarding the usage policy to the application itself for the application to enforce at least part of the usage policy. For example, an indication of limited functionality that the usage policy allows (such as restricting access to particular levels or other functionality of the application) can be provided to the application so that the application itself can prevent access to the restricted functionality.
• A request to run an application can be received by trustedcomputing base410 in a variety of different manners, such as a user input or a request from another component or module. In response to a request to run an application, trustedcomputing base410 notifies digitalrights management module416 of the request. Digitalrights management module416 attempts to obtain a license associated with the application.Module416 can obtain the associated license fromlicense store406, or alternatively can obtain the associated license from the licensing service. In one or more embodiments, digitalrights management module416 firstchecks license store406 for a license associated with the application package and uses such license if found instore406. If no such license is found instore406, then digitalrights management module416 requests such a license from a licensing service (e.g.,licensing service108 ofFIG. 1). This request for the license from the licensing service can optionally involve additional user input, such as user permission to access the licensing service, user permission to purchase a license from the licensing service, and so forth.
• If digitalrights management module416 is able to obtain a license associated with the application package that includes the application, then digitalrights management module416 and trustedcomputing base410 permit running of the application oncomputing device400 in accordance with the usage policy in the license associated with the application package. If digitalrights management module416 is not able to obtain a license associated with the application package that includes the application, then digitalrights management module416 prohibits running of the application oncomputing device400. However, if digitalrights management module416 were able to obtain a license associated with the application package that includes the application at a later time, then digitalrights management module416 permits running of the application oncomputing device400 at that later time in accordance with the usage policy in the license associated with the application package.
• Content server414 manages the running of the application oncomputing device400. In one or more embodiments,computing device400 supports a system architecture where individual components (such as a running application, trustedcomputing base410, digitalrights management module416, etc.) execute in protected or isolated areas of memory. The system architecture prohibits the individual components from accessing the memory area of a different individual component. The individual components can submit requests to different components and receive responses from different components, but are restricted from directly accessing the memory area of another component.
• To run an application, trustedcomputing base410 obtains an area of memory (e.g., from a memory manager component (not shown)) in which the application can be run. One or more files to be run for the application are obtained fromsecure file system412 and loaded into the memory area for the application. The particular file or files to be run and/or other operations to be performed to install the application can be identified as part of the application package (e.g., in metadata of the application package) or alternatively elsewhere. While the application is running, requests for additional files can be received bycontent server414 from the application.
• Secure file system412 manages interaction with the one or more files of the application as encrypted in the application package. To run the application,secure file system412 mounts a new virtual storage volume forcomputing device400. This new virtual storage volume is the virtual storage volume for which the one or more files are configured as discussed above. The one or more encrypted files in the application package are the information stored on the virtual storage volume. Additional data structures and/or other information describing the organization of the one or more files on the virtual storage volume can also be stored on the virtual storage volume and used bysecure file system412 in accessing the virtual storage volume.Secure file system412 receives a request for an individual one (or portions thereof) of the one or more files fromcontent server414, and identifies the appropriate encrypted segments that store that individual file. These requests can be requests fromcontent server414 to begin running the application, or requests received bycontent server414 while the application is running.
• Secure file system412 retrieves the encrypted segments in which the individual file is stored and decrypts those segments. This decryption is performed on a segment-by-segment basis, with individual segments being decrypted as they are requested.Secure file system412 can also optionally decrypt and cache one or more segments in anticipation of such segments being requested. This decryption is performed using a symmetric key, also referred to as the decryption key, and a symmetric decryption algorithm. The decryption key is the same key as was used as the encryption key by the application package creation service to encrypt the segments, and the symmetric decryption algorithm is the decryption algorithm corresponding to the encryption algorithm used by the application package creation service to encrypt the segments. This key is stored in the license associated with the application package as discussed above.
• Thus, it can be seen that the applications remain protected from being run by entities that do not have the rights to do so, and that the desired rights for the applications are enforced by computingdevice400. An individual application need have no knowledge of how the application is encrypted or otherwise protected, or even whether the application is encrypted or otherwise protected. Rather, when running the application simply requests the appropriate files or portions thereof fromcontent server414, and the application is shielded from any knowledge of the decryption performed bysecure file system412. The security of the techniques discussed herein is provided by the platform or system of computing device400 (e.g., trustedcomputing base410 and digital rights management module416) rather than the individual applications.
• It should also be noted that in one or more embodiments the application is fully encrypted in the application package. Both data and instruction files are encrypted in the application package. Alternatively, one or more files could be left unencrypted if desired.
• FIG. 5 is a flowchart illustrating anexample process500 for creating an application package in accordance with one or more embodiments.Process500 is carried out by an application package creation service, such asservice104 ofFIG. 1, and can be implemented in software, firmware, hardware, or combinations thereof.Process500 is shown as a set of acts and is not limited to the order shown for performing the operations of the various acts.Process500 is an example process for creating an application package; additional discussions of creating an application package are included herein with reference to different figures.
• Inprocess500, one or more files of an application are obtained (act502). These one or more files can be obtained in a variety of different manners and via a variety of different communication media as discussed above. These one or more files can be, for example all of the data and instructions used in executing the application.
• The one or more files are configured as a virtual storage volume (act504). This configuring of the one or more files allows each application to be mounted and accessed as its own virtual storage volume or virtual disk.
• An encryption key is obtained (act506). This encryption key is a symmetric key and can be generated or obtained in different manners as discussed above.
• The one or more files, configured as the virtual storage volume, are encrypted at a segment level using the obtained encryption key (act508). This segment level refers to encrypting the segments (e.g., disk blocks or sectors) of the virtual storage volume individually.
• The encrypted files are provided as an application package (act510). The application package can also include additional information, such as metadata and a digital signature as discussed above. The application can be provided to various computing devices as discussed above.
• Additionally, a license generation module can generate a license associated with the application package as discussed above. The license generation module can be included as part of the application creation service, or alternatively as part of another service (e.g., as part of a licensing service). The application package creation service can provide the encryption key to the license generation module, or alternatively the application package creation service and license generation module can independently derive the encryption key as discussed above.
• FIG. 6 is a flowchart illustrating anexample process600 for using an application package and associated license in accordance with one or more embodiments.Process600 is carried out by a computing device on which running of an application is requested, such ascomputing device102 ofFIG. 1, and can be implemented in software, firmware, hardware, or combinations thereof.Process600 is shown as a set of acts and is not limited to the order shown for performing the operations of the various acts.Process600 is an example process for using an application package and associated license; additional discussions of using an application package and associated license are included herein with reference to different figures.
• Inprocess600, an application package is obtained (act602). The application package can be communicated to thedevice implementing process600 in a variety of different manners as discussed above. The application package can be obtained, for example, in response to a request to run the application in the application package, or alternatively can be obtained prior to receiving a request to run the application.
• An attempt to authenticate the application package is made (act604). This attempted authentication comprises, for example, using a digital signature included in the application package to verify that the application package has not been changed since the digital signature was generated.
• If the application package is not authenticated, then the device refuses to execute the application (act606). However, a new application package that can be authenticated can be obtained by the device, in response to which the application could be executed (assuming an associated license permitted its execution).
• Although illustrated as a single act, the attempt to authenticate the application package can be made at different times. For example, an authentication of an initial portion of the application package (e.g., authentication of the metadata in the application package) can initially be made inact606. As subsequent portions of the application (e.g., code and/or resource portions) are accessed in executing the application, integrity information included in the metadata can be used to validate those subsequent portions. Alternatively, additional signatures generated by digitally signing the subsequent portions can be authenticated as the subsequent portions are accessed in executing the application. If a subsequent portion is not authenticated while an application is executing, then the device refuses to continue executing the application.
• If the application package is authenticated, then a license associated with the application package is obtained (act608). The license can be obtained from a local license store of thedevice implementing process600, or from a remote licensing service.
• A virtual storage volume that includes the application is mounted (act610). This virtual storage volume is mounted by the file system of thedevice implementing process600. As discussed above, the application package includes the appropriate data structures and/or other information describing the organization of the one or more files so that the file system can mount the virtual storage volume.
• At least part of the application package is decrypted (act612). One or more files of the application package are decrypted, as discussed above, using the key included in the license obtained inact608.
• The application is executed in accordance with the usage policy in the license associated with the application package (act614). Various restrictions on the execution of the application can be imposed by the usage policy, as discussed above.
• FIG. 7 illustrates anexample computing device700 that can be configured to implement the protecting applications with a key and usage policy in accordance with one or more embodiments.Computing device700 can be, for example,computing device102 ofFIG. 1,computing device400 ofFIG. 4, or can implement at least part ofservice200 ofFIG. 2 or aservice104,106, or108 ofFIG. 1.
• Computing device700 includes one or more processors orprocessing units702, one or more computerreadable media704 which can include one or more memory and/orstorage components706, one or more input/output (I/O)devices708, and abus710 that allows the various components and devices to communicate with one another. Computerreadable media704 and/or one or more I/O devices708 can be included as part of, or alternatively may be coupled to,computing device700.Bus710 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or local bus, and so forth using a variety of different bus architectures.Bus710 can include wired and/or wireless buses.
• Memory/storage component706 represents one or more computer storage media.Component706 can include volatile media (such as random access memory (RAM)) and/or nonvolatile media (such as read only memory (ROM), Flash memory, optical disks, magnetic disks, and so forth).Component706 can include fixed media (e.g., RAM, ROM, a fixed hard drive, etc.) as well as removable media (e.g., a Flash memory drive, a removable hard drive, an optical disk, and so forth).
• The techniques discussed herein can be implemented in software, with instructions being executed by one ormore processing units702. It is to be appreciated that different instructions can be stored in different components ofcomputing device700, such as in aprocessing unit702, in various cache memories of aprocessing unit702, in other cache memories of device700 (not shown), on other computer readable media, and so forth. Additionally, it is to be appreciated that the location where instructions are stored incomputing device700 can change over time.
• One or more input/output devices708 allow a user to enter commands and information tocomputing device700, and also allows information to be presented to the user and/or other components or devices. Examples of input devices include a keyboard, a cursor control device (e.g., a mouse), a microphone, a scanner, and so forth. Examples of output devices include a display device (e.g., a monitor or projector), speakers, a printer, a network card, and so forth.
• Various techniques may be described herein in the general context of software or program modules. Generally, software includes routines, programs, objects, components, data structures, and so forth that perform particular tasks or implement particular abstract data types. An implementation of these modules and techniques may be stored on or transmitted across some form of computer readable media. Computer readable media can be any available medium or media that can be accessed by a computing device. By way of example, and not limitation, computer readable media may comprise “computer storage media” and “communications media.”
• “Computer storage media” include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer.
• “Communication media” typically embody computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as carrier wave or other transport mechanism. Communication media also include any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above are also included within the scope of computer readable media.
• Generally, any of the functions or techniques described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or a combination of these implementations. The terms “module” and “component” as used herein generally represent software, firmware, hardware, or combinations thereof. In the case of a software implementation, the module or component represents program code that performs specified tasks when executed on a processor (e.g., CPU or CPUs). The program code can be stored in one or more computer readable memory devices, further description of which may be found with reference toFIG. 7. The features of the protecting applications with a key and usage policy techniques described herein are platform-independent, meaning that the techniques can be implemented on a variety of commercial computing platforms having a variety of processors.
• Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims (20)

1. A method implemented in an application package creation service, the method comprising:

obtaining one or more files of an application;

configuring the one or more files as a virtual storage volume; and

generating an application package by encrypting, using an encryption key, the one or more files configured as a virtual storage volume, wherein a license generation module can generate a license including both a usage policy for the application and the encryption key.

2. A method as recited inclaim 1, wherein the license generation module is included as part of a licensing service separate from the application package creation service, the method further comprising securely communicating both the encryption key and an identifier of the application package to the license generation module for inclusion in the license.

3. A method as recited inclaim 1, wherein the license generation module is included as part of a licensing service separate from the application package creation service, and wherein the application package creation service and the license generation module independently derive the encryption key based on a shared secret.

4. A method as recited inclaim 1, the encrypting the one or more files comprises encrypting individual segments of each of the one or more files, each individual segment being a disk block on which at least part of one of the one or more files is stored.

5. A method as recited inclaim 1, further comprising generating a digital signature by digitally signing the encrypted one or more files, and including the digital signature in the application package.

6. A method as recited inclaim 5, wherein the digitally signing comprises digitally signing both metadata included in the application package and the encrypted one or more files, the metadata including an identifier of the application package.

7. A method as recited inclaim 1, wherein the encryption key associates the license with the application package.

8. A method as recited inclaim 1, wherein the one or more files of the application include data and instructions used in executing the application.

9. A method as recited inclaim 1, wherein generating the application package further comprises:

generating an identifier of the application package;

including the identifier of the application package in the application package;

generating a digital signature by digitally signing the encrypted one or more files; and

including the digital signature in the application package.

10. One or more computer storage media having stored thereon multiple instructions, execution of which, by one or more processors of a computing device, causes the one or more processors to:

obtain an application package including an encrypted application;

attempt to authenticate the application package;

if the application package is authenticated, then:

obtain a license associated with the application package,

mount a virtual storage volume that includes the application,

decrypt at least part of the application package using a decryption key in the license, and

execute the application; and

if the application is not authenticated, then refuse to execute the application.

11. One or more computer storage media as recited inclaim 10, wherein to attempt to authenticate the application package is to verify a digital signature in the application package, the digital signature having been generated by digitally signing one or more files of the application in the application package.

12. One or more computer storage media as recited inclaim 10, wherein to execute the application is to execute the application in accordance with a usage policy included in the license.

13. One or more computer storage media as recited inclaim 10, wherein the license associated with the application package includes a first application package identifier that is the same as a second application package identifier included in the application package.

14. One or more computer storage media as recited inclaim 10, wherein to obtain the license is to obtain an encrypted license from a licensing service, and retrieve the license by decrypting the encrypted license using a private key of the computing device.

15. One or more computer storage media as recited inclaim 10, wherein to decrypt at least part of the application package is to decrypt individual segments of the virtual storage volume on a segment-by-segment basis.

16. One or more computer storage media as recited inclaim 15, wherein execution of the multiple instructions further causes the one or more processors to:

receive from the application, while the application is executing, a request for data;

identify one or more segments of the virtual storage volume in which the data is stored;

decrypt the identified one or more segments; and

return the data in the one or more decrypted segments to the application.

17. One or more computer storage media as recited inclaim 10, wherein the decryption key associates the license with the application package.

18. One or more computer storage media as recited inclaim 10, wherein the application executes in an isolated area of memory that other applications are restricted from accessing.

19. One or more computer storage media as recited inclaim 10, wherein the application package includes:

the encrypted application;

metadata including an identifier of the application package; and

a digital signature having been generated by digitally signing the identifier of the application package and the encrypted application.

20. A method in a computing device, the method comprising:

obtaining an application package from an application package distribution service, the application package including:

an encrypted application,

metadata including an identifier of the application package, and

a digital signature generated by digitally signing the identifier of the application package and the encrypted application;

attempting to authenticate the application package by verifying the digital signature in the application package;

if the application package is authenticated, then:

obtaining a license associated with the application package, the license including a decryption key and usage policy,

mounting a virtual storage volume that includes the application,

decrypting at least part of the application package using the decryption key in the license, and

executing the application in accordance with the usage policy, and decrypting and returning to the application one or more additional parts of the application package in response to requests for data from the application; and

if the application is not authenticated, then refusing to execute the application.

Images